Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30/09/2023, 06:54
Behavioral task
behavioral1
Sample
4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
Resource
win10v2004-20230915-en
General
-
Target
4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
-
Size
1.3MB
-
MD5
851e5c879e22248f985170716734c35f
-
SHA1
62e337a35f602214df52b0de96a45ce28b636e70
-
SHA256
4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97
-
SHA512
ab8b494895d27eb8f12beecbd412fb9653ffcc1b6ef5a35c8eec8c9bbe3355e0e8d6a4cad47ad5a3dc05c42065d208ec91ebdcef50f77809cf6fea6573201070
-
SSDEEP
24576:TVP4iQzePuruuXj/cjtkugLwnNM9bEjryZFmTcHAdyZbX62z9tywY3+Q:TWBj/cjt1OwNMhS+ZLgdIbX6K9tywq+
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2360 ~~6226934850326949901.tmp.exe 2740 svchost.exe 2144 ~~6226934850326949901.tmp.exe 1796 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 2740 svchost.exe -
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x00000000005D8000-memory.dmp upx behavioral1/memory/3060-2-0x0000000000400000-0x00000000005D8000-memory.dmp upx behavioral1/memory/3060-4-0x0000000000400000-0x00000000005D8000-memory.dmp upx behavioral1/memory/2196-45-0x0000000000400000-0x00000000005D8000-memory.dmp upx behavioral1/memory/1340-46-0x0000000000400000-0x00000000005D8000-memory.dmp upx behavioral1/memory/1340-47-0x0000000000400000-0x00000000005D8000-memory.dmp upx -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe ~~6226934850326949901.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 1636 PING.EXE 1520 PING.EXE 2100 PING.EXE 2780 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 ~~6226934850326949901.tmp.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeBackupPrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeRestorePrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeBackupPrivilege 3060 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeRestorePrivilege 3060 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 3060 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 3060 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeBackupPrivilege 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeRestorePrivilege 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: 33 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe Token: SeIncBasePriorityPrivilege 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2144 ~~6226934850326949901.tmp.exe 2144 ~~6226934850326949901.tmp.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2196 wrote to memory of 3060 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 28 PID 2196 wrote to memory of 3060 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 28 PID 2196 wrote to memory of 3060 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 28 PID 2196 wrote to memory of 3060 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 28 PID 2196 wrote to memory of 2360 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 29 PID 2196 wrote to memory of 2360 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 29 PID 2196 wrote to memory of 2360 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 29 PID 2196 wrote to memory of 2360 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 29 PID 2360 wrote to memory of 2740 2360 ~~6226934850326949901.tmp.exe 30 PID 2360 wrote to memory of 2740 2360 ~~6226934850326949901.tmp.exe 30 PID 2360 wrote to memory of 2740 2360 ~~6226934850326949901.tmp.exe 30 PID 2360 wrote to memory of 2740 2360 ~~6226934850326949901.tmp.exe 30 PID 2740 wrote to memory of 2144 2740 svchost.exe 31 PID 2740 wrote to memory of 2144 2740 svchost.exe 31 PID 2740 wrote to memory of 2144 2740 svchost.exe 31 PID 2740 wrote to memory of 2144 2740 svchost.exe 31 PID 2196 wrote to memory of 1340 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 33 PID 2196 wrote to memory of 1340 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 33 PID 2196 wrote to memory of 1340 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 33 PID 2196 wrote to memory of 1340 2196 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 33 PID 1340 wrote to memory of 632 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 34 PID 1340 wrote to memory of 632 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 34 PID 1340 wrote to memory of 632 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 34 PID 1340 wrote to memory of 632 1340 4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe 34 PID 632 wrote to memory of 1636 632 cmd.exe 36 PID 632 wrote to memory of 1636 632 cmd.exe 36 PID 632 wrote to memory of 1636 632 cmd.exe 36 PID 632 wrote to memory of 1520 632 cmd.exe 37 PID 632 wrote to memory of 1520 632 cmd.exe 37 PID 632 wrote to memory of 1520 632 cmd.exe 37 PID 632 wrote to memory of 2100 632 cmd.exe 38 PID 632 wrote to memory of 2100 632 cmd.exe 38 PID 632 wrote to memory of 2100 632 cmd.exe 38 PID 632 wrote to memory of 2780 632 cmd.exe 39 PID 632 wrote to memory of 2780 632 cmd.exe 39 PID 632 wrote to memory of 2780 632 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe"C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exePECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe""#102|SCRIPT"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"3⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\system32\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1636
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1520
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2100
-
-
C:\Windows\system32\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2780
-
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404B
MD5eefd2ab70bd575260278921a63f2d16a
SHA1946e3dcf1473ebbb6353f4e13664631d44bf26d1
SHA2567e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030
SHA5126a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea
-
Filesize
404B
MD5eefd2ab70bd575260278921a63f2d16a
SHA1946e3dcf1473ebbb6353f4e13664631d44bf26d1
SHA2567e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030
SHA5126a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea
-
Filesize
1013KB
MD5a681dcd188b1845fda9f078c1a3b2138
SHA1c8552e6bd406397323490a2b01792f8878588183
SHA256ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443
SHA512350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf
-
Filesize
1013KB
MD5a681dcd188b1845fda9f078c1a3b2138
SHA1c8552e6bd406397323490a2b01792f8878588183
SHA256ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443
SHA512350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf
-
Filesize
1.0MB
MD51d886abc09404b92a7ff409f702ab5e3
SHA10ce1d79cecd30972f65ba36ba8764a61c59bbfaa
SHA256313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b
SHA512276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92
-
Filesize
1.0MB
MD51d886abc09404b92a7ff409f702ab5e3
SHA10ce1d79cecd30972f65ba36ba8764a61c59bbfaa
SHA256313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b
SHA512276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92
-
Filesize
35KB
MD513e083a9d53e948803694a603e69081a
SHA15f0926b43c970edad8b969cbec9cfebb5ad0a971
SHA256305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5
SHA512a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814
-
Filesize
35KB
MD513e083a9d53e948803694a603e69081a
SHA15f0926b43c970edad8b969cbec9cfebb5ad0a971
SHA256305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5
SHA512a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814
-
Filesize
35KB
MD513e083a9d53e948803694a603e69081a
SHA15f0926b43c970edad8b969cbec9cfebb5ad0a971
SHA256305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5
SHA512a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814
-
Filesize
35KB
MD513e083a9d53e948803694a603e69081a
SHA15f0926b43c970edad8b969cbec9cfebb5ad0a971
SHA256305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5
SHA512a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814
-
Filesize
1013KB
MD5a681dcd188b1845fda9f078c1a3b2138
SHA1c8552e6bd406397323490a2b01792f8878588183
SHA256ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443
SHA512350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf
-
Filesize
1.0MB
MD51d886abc09404b92a7ff409f702ab5e3
SHA10ce1d79cecd30972f65ba36ba8764a61c59bbfaa
SHA256313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b
SHA512276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92